WebAssembly

A "virtual" (fake) Assembly Language which can be quickly compiled (even to native machine code) and executed by modern browsers. The program runs in a "web worker" which is isolated but able to pass data back and forth between Javascript running on the web page. The javascript can call functions in the web assembly, and the web assembly can call functions in the javascript, if they are exposed via an environment object in the call to the web assembly.

The web assembly program can not interact with the Dom or user except via Javascript function call.

Programming directly in WebAssembly is certainly possible.

Another interesting feature is that many compilers have been written which can run in the browser (no install required), and compile other languages to wasm.

For example: The following code demonstrates calling js functions from "C" compiled via C11 to WebAssembly by the . The "C" code (on the left) is

 
#if defined(__cplusplus)
#define cppexport extern "c" // to prevent C++ name mangling
#else
#define cppexport
#endif
cppexport int foo(int x) {
  bar(x);
  return x+1;
}

and the JS (on the right) is

var wasmModule = new WebAssembly.Module(wasmCode);
var wasmImports = { env: { bar: function(arg) { log('Got it: '+arg)} } };
var wasmInstance = new WebAssembly.Instance(wasmModule, wasmImports);
log(wasmInstance.exports.foo(4));

There is also "waforth" which is a FORTH, written in wasm, which then compiles in wasm and executes in the browser. (And one of the demos is a turtle environment like a cross between LOGO and FORTH)

In general, this ability to port existing code into WebAssembly provides a path forward for existing programs written on or for legacy systems. For eaxample, this HBC-56 (6502/TMS9918) emulator was port to WebAssembly.
https://visrealm.github.io/hbc-56/github-pages/emulator

WAM currently does not support garbage collection, but that extension is underway in several browsers.

Security

WASM has the same sandboxing support as JVM. It does not itself interoperate with the browser's complicated DOM model of a page. All such things are done by calling into javascript libraries. It is typically used inside of the (very complex) software environments of current browers, but can in theory also be used in simpler non-browser environments.

WASM supports similar defenses against imported malware as for javascript. But the low level of imported WASM code makes it easier to hide the actual intent and actions of the imported code. At one point, a survey of all uses of WASM on the web found that half !! were instances of a malware program.